Ulf Möller <[EMAIL PROTECTED]> wrote:
> > The seed generation *is* the RNG. What happens later is a PRNG, not an
RNG.
> > An RNG with a poor seed is always a poor RNG.
>
> OpenSSL does not contain a "RNG". It uses a cryptographic PRNG, which
> you as the application programmer have to initialize by calling
> RAND_seed() with appropriate input.
Ok.
> In the case of Windows, one method for creating such input is to ask
> the user to move the mouse and use the the coordinates of the
> WM_MOUSEMOVE messages you get and the respective system time.
It seems to be a good choice.
Has anyone added such a feature to RAND_seed()?
If not I propose fix it for the next OpenSSL-Release.
Thanks,
Miguel Angel
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
